GitHub Advisory DatabaseGHSA-FV7X-V67W-CVQVSpring Data REST can expose hidden entity attributes
3.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
42.3%
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.springframework.data:spring-data-rest-core | lt | 3.7.3 | |
| org.springframework.data:spring-data-rest-core | lt | 3.6.7 |
References
github.com/advisories/GHSA-fv7x-v67w-cvqv
github.com/spring-projects/spring-data-rest/commit/2ad081f75b4baabfbc139f0dc2b75c54889b4053
github.com/spring-projects/spring-data-rest/commit/bf37590b25a0c066f67547b39fb4d7294e2c7cb7
nvd.nist.gov/vuln/detail/CVE-2022-31679
tanzu.vmware.com/security/cve-2022-31679
Related
3.7 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
42.3%